# Azure AD login with OpenID loop **URL:** https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034 **Category:** Security **Created:** [May 27, 2021, 6:38pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034 "2021-05-27T18:38:16Z") **Posts on this page:** 9 **Page:** 1
### Author: ![leo\_gazziro](https://avatars.discourse-cdn.com/v4/letter/l/f07891/32.png) [@leo\_gazziro](https://forum.opensearch.org/u/leo_gazziro) #### Post date: [May 27, 2021, 6:38pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/1 "2021-05-27T18:38:16Z")
Hi guys. I’m trying to do login in Kibana using Azure ID and OpenID but the Azure login create a loop. ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/5/5889883fd9f9bc0b8da717d43c5a837a44a6d53d.png) My configs: config.yml ```auto authc: basic_internal_auth_domain: http_enabled: true transport_enabled: true order: 0 http_authenticator: type: "basic" challenge: false authentication_backend: type: "internal" openid_auth_domain: enabled: true order: 1 http_authenticator: type: openid challenge: false config: subject_key: preferred_username roles_key: roles openid_connect_url: https://login.microsoftonline.com//v2.0/.well-known/openid-configuration authentication_backend: type: noop ``` kibana.yml: ```auto opendistro_security.auth.type: "openid" opendistro_security.openid.connect_url: "https://login.microsoftonline.com//v2.0/.well-known/openid-configuration" opendistro_security.openid.client_id: "" opendistro_security.openid.client_secret: "" opendistro_security.openid.base_redirect_url: "http://localhost:5601" ``` Does anyone have any idea what can cause the problem? ---
### Author: ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/9946_2.png) [@pablo](https://forum.opensearch.org/u/pablo) #### Post date: [May 28, 2021, 9:39am UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/2 "2021-05-28T09:39:42Z")
Hi @leo_gazziro Could you try to set in openid\_auth\_domain the below settings. http\_enabled: true (instead of enabled:true) transport\_enabled: false Do you see any errors in ES logs? What ODFE version are you running? ---
### Author: ![oscark](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/oscark/32/866_2.png) [@oscark](https://forum.opensearch.org/u/oscark) #### Post date: [May 28, 2021, 12:18pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/3 "2021-05-28T12:18:57Z")
When it fails to authenticate it can end up in these kind of loops. I would expect that the problem gets logged in elasticsearch logs. I think when I had an issue like this it was because the elastic nodes did not have a route to my openid servers (and my subject\_key was wrong). Also is `` correct? ---
### Author: ![leo\_gazziro](https://avatars.discourse-cdn.com/v4/letter/l/f07891/32.png) [@leo\_gazziro](https://forum.opensearch.org/u/leo_gazziro) #### Post date: [May 28, 2021, 3:56pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/4 "2021-05-28T15:56:37Z")
@pablo I tryed to change http enable and transport config but doesn’t work. My ODFE version 1.13.0.1 About the logs, it doesn’t have relevant informations, I need to active somenting? Thanks for helping guys ---
### Author: ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/9946_2.png) [@pablo](https://forum.opensearch.org/u/pablo) #### Post date: [May 28, 2021, 8:41pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/5 "2021-05-28T20:41:06Z")
@leo_gazziro Try to follow the ODFE documentation and enable either debug or trace logging. Trace will provide more verbose output. > **[Troubleshoot OpenID Connect](https://opendistro.github.io/for-elasticsearch-docs/docs/troubleshoot/openid-connect/#set-log-level-to-debug)** > > Documentation for Open Distro, the community-driven, 100% open source distribution of Elasticsearch OSS with advanced security, alerting, deep performance analysis, and more. ---
### Author: ![leo\_gazziro](https://avatars.discourse-cdn.com/v4/letter/l/f07891/32.png) [@leo\_gazziro](https://forum.opensearch.org/u/leo_gazziro) #### Post date: [June 1, 2021, 8:31pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/6 "2021-06-01T20:31:16Z")
Hi @pablo Sorry for my delay. ES log have this message: [2021-06-01T20:27:45,668][WARN][c.a.o.s.h.HTTPBasicAuthenticator] [teste-kibana] No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’ ---
### Author: ![leo\_gazziro](https://avatars.discourse-cdn.com/v4/letter/l/f07891/32.png) [@leo\_gazziro](https://forum.opensearch.org/u/leo_gazziro) #### Post date: [June 1, 2021, 8:32pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/7 "2021-06-01T20:32:10Z")
Hi @pablo ES log have this message: [2021-06-01T20:27:45,668][WARN][c.a.o.s.h.HTTPBasicAuthenticator] [teste-kibana] No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’ ---
### Author: ![a.fauquer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/a.fauquer/32/1548_2.png) [@a.fauquer](https://forum.opensearch.org/u/a.fauquer) #### Post date: [June 2, 2021, 2:02pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/8 "2021-06-02T14:02:49Z")
Hello, we are having the same problem. We are installing Wazuh on docker-compose, which has the opendistro containers. Our oidc provider is keycloack. if anyone knows how to fix it, that would be great, thanks ---
### Author: ![gdd314596](https://avatars.discourse-cdn.com/v4/letter/g/ed8c4c/32.png) [@gdd314596](https://forum.opensearch.org/u/gdd314596) #### Post date: [June 7, 2021, 5:25pm UTC](https://forum.opensearch.org/t/azure-ad-login-with-openid-loop/6034/9 "2021-06-07T17:25:44Z")
Had the same issue. See solution here: [Issue with openid/keycloak causing infinite redirects with Helm - #4 by gdd314596](https://forum.opensearch.org/t/issue-with-openid-keycloak-causing-infinite-redirects-with-helm/5429/4)